Cryptography is concerned with the secure transmission of private information between two parties (referred to conventionally as Alice and Bob). When a classical communication channel is used, there is always the possibility that a third party (referred to as Eve) may eavesdrop on the channel. Thus, techniques must be used to secure the privacy of the transmitted information. For example, in classical cryptography Alice typically uses a cryptographic key to encrypt the information prior to transmission over the channel to Bob, so that it remains secure even if the channel is public. In order for Bob to decrypt the message, however, the cryptographic key must be communicated. Thus, to securely share private information, Alice and Bob already must have shared private information, namely the cryptographic key. A basic problem of cryptography, therefore, is how to initially establish a private key between Alice and Bob, and how to ensure that such a key distribution technique is secure against Eve.
Quantum key distribution (QKD) provides a solution to this basic problem of cryptography. Using techniques that take advantage of distinctively quantum-mechanical phenomena, it is possible to securely establish a private encryption key between Alice and Bob and guarantee that Eve has not eavesdropped on the communication. Quantum key distribution can provide this guarantee because quantum phenomena, in contrast with classical phenomena, cannot be passively observed or copied, even in principle. The very observation of quantum phenomena by Eve actively alters their characteristics, and this alteration can be detected by Alice and Bob.
Typically, QKD techniques use photons whose properties are measured by Alice and Bob. After each party measures a property of each photon, Alice and Bob then communicate limited information about their measurements using any conventional public communication channel. The limited information is not enough to allow Eve to obtain useful information, but it is enough to allow Alice and Bob to determine whether or not Eve attempted to observe the photons. If not, then the information allows Alice and Bob to sift the measurements and obtain a sifted key. From this sifted key they can then secretly determine a common cryptographic key, typically using error correction and privacy amplification techniques. Thus, this technique provides an inherently secure method for establishing a cryptographic key. Once the key is established using such a QKD technique, it can be used with conventional cryptographic techniques to provide secure private communication between Alice and Bob over a public communication channel.
Over the years, several different protocols for QKD have been proposed. In 1984 C. H. Bennett and G. Brassard proposed the first QKD protocol (BB84), published in Proc. Of IEE Int. Conf. On Computers, Systems, and Signal Processing, Bangalore, India (IEEE, New York, 1984), p. 175. The BB84 protocol involves the transmission of a photon from Alice to Bob, where the preparation and measurement of the photons use four non-orthogonal quantum states (e.g., polarization states 0 and 90 degrees, and 45 and −45 degrees). In 1992 Bennet showed that the protocol can also be implemented with only two states. In 1991 A. K. Ekert published a variant protocol (E91) in Phys. Rev. Lett., 67, 661 (1991) which involves entangled quanta (i.e., quantum Bell states) sent from a common source to Alice and Bob. C. H. Bennet, G. Brassard, and N. D. Mermin published a similar protocol (BBM92) in Phys. Rev. Lett., 68, 557 (1992) based on quantum entanglement. There are various implementations of the BBM92 entanglement approach. One uses polarization entanglement, and is described in J. Jennewein et al., Phys. Rev. Lett. 84, 4729 (2000). This approach suffers from practical problems due to the fact that the polarization state of light changes in optical fibers due to randomly varying birefringence. Another version of BBM92 uses energy-time (i.e., phase-time) entangled Bell states, and is described in W. Tittle et al., Phys. Rev. Lett., 84, 4737 (2000). Because energy-time entanglement is robust against perturbations of fiber transmission characteristics, this approach has practical advantages over the use of polarization entanglement.
According to Tittle's energy-time entanglement technique, an entangled photon pair is generated using a pulsed laser 100, an optical interferometer 110, and a parametric down-converter 120, as illustrated in FIG. 1. The two arms of the interferometer 110 have different path lengths (specified by a phase difference φ), effectively splitting a single laser pulse into a superposition of two time-separated pulses. A nonlinear crystal is used as the parametric down-converter 120, producing an entangled down-converted photon pair in a maximally-entangled Bell state. The two down-converted photons are directed to a coupler 125 that separates the pairs, one going to Alice and one going to Bob. When an appropriate phase matching condition in parametric down conversion is satisfied, two photons of the entangled pair have different wavelengths. Thus, the photons can always be separated by a wavelength division multiplexing (WDM) coupler 125, and each goes to Alice or Bob, respectively.
At each receiver is an interferometer 130 and two single-photon counters 140, 150 at its two outputs. Thus, each photon is further split at the receiver into a superposition of two time-separated photons. The interferometer arms have unequal path length differences (specified by phases α and β) which are selected so that the time delays at the receiver interferometers 130 are equal to the time delay at the source interferometer 110. Consequently, each photon will be measured in one of three time slots, depending on whether (1) the photon took short paths through both interferometers (state |S>|S>), (2) a short path and a long path (states |S>|L>or |L>|S>), or (3) two long paths (state |L>|L>). Because the photon pair is generated in a maximally-entangled quantum state, the two receivers will be correlated in either their measurement of which interferometer route the photons took (time) or their measurement of which detectors the photons triggered (phase).
In order to build up the secret key, for each event Alice and Bob publicly disclose limited information about their measurements. In particular, Alice discloses for each event whether or not the photon was detected in the second time slot and Bob discloses the same information about his measurements. In ¼ of the events, both Alice and Bob will disclose that they detected a photon in the second time slot. In this case, they both know that their photons are correlated in phase (the energy base). Consequently, by appropriately assigning their two interferometer detectors bit values 0 and 1, they can obtain correlated bit values. Because only Alice and Bob know which detector their photons arrived at, these bit values are completely private. In another ¼ of the events, both Alice and Bob will disclose that they did not detect a photon in the second time slot. In this case, they know that their photons are correlated in time (the time base). They can thus obtain correlated bit values by assigning the first and third time slots bit values 0 and 1. Because only Alice and Bob know which time slot the photon arrived in, these bit values are completely private. In another ¼ of the events, Alice detects a photon in the second time slot while Bob detects a photon in the first or third time slot. In this cases there is a basis mismatch and no correlated bit can be assigned. Similarly, there is a basis mismatch in another ¼ of the events where Bob detects a photon in the second time slot while Alice detects a photon in the first or third time slot. Thus, only half of the events can be used for key creation.
One disadvantage of this particular approach to QKD is its comparatively low communication efficiency due to the fact that the efficiency of the parametric down-conversion must be kept low. High parametric down-conversion would result in a high probability of generating more than two photon pairs per pulse, and/or a high probability of generating photon pairs in sequential pulses. The system requires these probabilities to be low, so that these undesired events do not happen often.
Another disadvantage of the above approach to QKD is that it requires delicate phase control in the source interferometer. The reason for this requirement is that the phase correlation between the photon pairs generated in the parametric down-conversion process depends on the exact phase difference between the two time-separated photons that come out of the source interferometer. Because the phase correlation between the photon pairs must be stable to provide reliable bit correlations in the case where both Alice and Bob detect photons in the second time slot, the source interferometer must be delicately controlled to preserve the phase difference between its two arms.
It would be an advance in the art of QKD to provide a technique to overcome these and other disadvantages.